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TO: Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Sir: 

DECLARATION UNDER 37 CFR 1.132 

I, James D. Isaak, declare that I have the following background in the field of 
Computer Science: 

I. Education : 

BS, Computer Studies, MSEE, Computer Engineering, Stanford University (1972) 
n. Work Experience : 

2002-present: Assistant Professor, Southern New Hampshire University, 
Manchester, NH 

2000-2002: Adjunct Professor, Daniel Webster College and New Hampshire 
Coriimunity Technical College, Nashua, NH 
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1987-1999: Compaq Computer (Digital Equipment Corporation), Nashua, NH 
1981-1987 Charles River Data Systems, Cambridge, MA 
Continuing Education: Leadership New Hampshire, Class of 2002; Continuing 
technical development in HTML, XML, web technology, Visual Basic, Access, and Linux 

I further declare that I am currently working as an Assistant Professor, Information 
Technology, Southern New Hampshire University, and am presently teaching courses on 
hiformation Technology Management, E-Commerce and Introduction to Information 
Technology. I also have about thirty years of industry experience with companies 
including Digital, Data General, Intel and IBM, much of which has been spent working on 
operating systems and standards, including security standards and mechanisms. I am a 
senior member of IEEE, current member of the Computer Society Board of Govemors, and 
past member of the IEEE Board of Directors as well as various other roles. I received the 
Hans Karlsson award for my leadership of the POSDC Operating Systems standards at the 
national and intemational level. 

I still further declare that there is an essential difference between access control and 
secure memory. Access control is a method by which you determine if access should be 
granted to a resource. Secure memory is a resource or product with specific protected 
content; in many cases the nature of the content dictates the protection mechanisms. 
Access control, on the contrary, is closely coupled with the concept of "authentication". 
One of the resources that might be protected by an access control mechanism is a secure 
memory product. If an access control mechanism is invalidly used, the invalid user might 
be able to gain access to, for example, a computer's non-secure memory, but the invalid 
user cannot access secure memory. A metric of quality for a secure memory is the level of 
resistance it has to having content accurately interpreted. 

For example, if non-secure memory somehow becomes available to a user, the 
contents of the non-secure memory — the binary signals - could present patterns that those 
skilled in the art could use to decipher the remaining contents. For example, ASCII 
characters have particular standard codes that are readily discemable upon inspection. On 
the other hand, if a user gains access to secure memory - memory in which the binary 
signals in memory have been systematically changed according to a known methodology - 
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inspection of the memory patterns does not lead to deciphering the contents of memory 
unless the user understands the known methodology that led to the systematic change 
during the securing process. Thus, a simple access control mechanism does not allow a 
user to review secure memory unless the user additionally employs the known 
methodology to return the memory to its original state. Non-secure memory, in contrast, is 
in its original state. 

For a second example, a set of files of CIA field operations has very sensitive 
content that should be stored in a "secure memory" product that would make unauthorized 
access extremely expensive if not impossible. Associated with this is some list of persons 
and the rights they have to any specific file. This list, also very sensitive, could be used as 
a part of an access control mechanism to determine if content of a file fi-om the secure 
memory should be made available. Often the actual access control methods or processes 
are "public", but there are cases where the methods and the information about the 
personnel who have particular rights require protection. It is very likely in this scenario 
that the list of persons and rights would also be stored in a secure memory product. One of 
the problems with some forms of "access control" is that they reveal content that owners 
would like to protect. The key difference between "access control" and "secure memory" 
is the actual content of the memory. 

I even fiirther declare that all statements made herein of my own knowledge are true 
and that all statements made on information and behef are believed to be true; and fiirther 
that these statements were made with the knowledge that willfiil false statements and the 
like so made are punishable by fine or imprisonment, or both, under Section 1001 of Title 
18 of the United States Code and that such willfiil false statements may jeopardize the 
validity of tjae application or any patent issued thereon. 




Jarti^s D. Isaak 
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